I would use a standard open source product like keycloak for user management and all related permission, authentication and authorization handling. Most requirements like you said sso, connecting to active directory, etc can be solved out of the box then. When working with such a product you learn a lot about security, as you need to configure all the things.
Ask HN: Main things to consider when building an app for business/enterprise?
11–20 of 132 posts
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#12I would use a standard open source product like keycloak for user management and all related permission, authentication and authorization handling. Most requirements like you said sso, connecting to active directory, etc can be solved out of the box then. When working with such a product you learn a lot about security, as you need to configure all the things.
I can't second this strongly enough. You will be asked for SSO, SCIM and so on very quickly by any sizable business. Using a mature auth solution will save you a lot of work.
(If on AWS, you might also want to look at AWS Cognito. I've not worked with Azure or Google Cloud so no idea about those)
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#13Build and design for multi tenancy all the way down to your schema.
Keep identity and login mechanism decoupled - plan to support multiple login mechanisms per user (email/password, SAML, OpenID Connect, Google) for a single identity and multiple authentication factors (TOTP, Duo, etc). Be very careful to about what you consider a verified user and how you verify email addresses.
Use TLS even for your database connections. Use encryption at rest. Automate backups and plan to restore or export data for specific customers rather than the whole application.
Use a time series database or event logging system and create an audit trail of everything any privileged user does in your system, any account or permissions changes, destructive operations, etc.
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#14Find a cofounder or two who enjoy the sales and outreach aspects of things.
Since you identify as a full stack developer first, that probably means you’re not looking for hours and hours of time spent in Excel or QuickBooks or SAP, doing sales forecasting, etc. But those are important for big sales efforts. Instead, find people who like that, and are talented at it with a consistent track record.
I recommend this partially because I followed that approach, and we’ve had our company going for over a decade.
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#15My advice would be to get waaaaaaaay more specific about what you want to do, then find a business partner who knows the "ins and outs" of the industry and has a few contacts you folks can use to get your foot in the door.
Forget about going after enterprise level customers. Prove yourself to the small and medium sized businesses first.
Before you do any technical work, be able to answer the question: why on Earth should businesses use what you're offering? There's no right answer here, but your answer should be super convincing. I think the most common is that you are able to beat the competition on price (cuz you're going to have such low overhead, I presume), but you'll need more than that.
Hope that helps. As others have said, I believe I'd be more helpful if you were more specific on what you were trying to accomplish.
Best of luck!
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#16Frankly, you have no chance of making a secure product if you don't have a ton of experience in this area.
For single sign on, SAML for instance, you have to get a ton right with security certificates, xml parsing, manifest rules, signing algorithms, request expiration, etc. SAML (and other single sign-on protocols) are poorly designed and any single mistake is fatal. Some SAML libraries have support for null signing for instance, which allows anybody to sign on as anybody by simply sending a null-signed response. If you don't know about this attack vector you would never think of testing for it. There are many similar SAML pitfalls and you have to think hard about all of them.
For password reset you have to think what kind of tokens you use. How and when they expire. How to protect against length extension attacks (use HMAC).
Anyway, I'm not writing this to discourage you. If you want to go for it, go for it. But enterprise saas software is a serious responsibility and you'll have to work hard at security even though there is no business upside to it.
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#17Ready to deploy your service/product on-prem environment. The main problem with on prem deployment is maintaining multiple versions. try to make sure you have better test coverage from day 1. in saas its easier to push the changes but on prim setup even minor update will take months from taking approval to deployment.
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#18Build and design for multi tenancy all the way down to your schema. Keep identity and login mechanism decoupled - plan to support multiple login mechanisms per user (email/password, SAML, OpenID Connect, Google) for a single identity and multiple authentication factors (TOTP, Duo, etc). Be very careful to about what you consider a verified user and how you verify email addresses. Use TLS even for your database connec…
There are additional requirements about exporting logs in real time (Splunk, etc), and sharing data via mechanisms like S3, if your service needs to sell to highly regulated industries. You’ll need third party audit findings as well.
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#19Build and design for multi tenancy all the way down to your schema. Keep identity and login mechanism decoupled - plan to support multiple login mechanisms per user (email/password, SAML, OpenID Connect, Google) for a single identity and multiple authentication factors (TOTP, Duo, etc). Be very careful to about what you consider a verified user and how you verify email addresses. Use TLS even for your database connec…
As an alternative, if you containerize everything in the stack, you can simply spool up another seperate and isolated stack of containers for each given customer. Then it's also trivial if they want it 'on premise' somewhere or 'in the cloud'. No need to try and add complexity at the schema level and make a monolith support multiple tenants.
Also, this list is quite literally supabase (https://supabase.com/) - I cannot recommend enough, especially if OP is solo, which it sounds like is the case.
Re: Ask HN: Main things to consider when building an app for business/enterprise?
#20Have a potential customer before you build anything.